{"id":"CVE-2026-61682","title":"kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads","summary":"kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* i…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-290","CWE-302","CWE-348"],"vendor":"kcp-dev","product":"kcp","affected":["kcp < 0.31.4","kcp >= 0.32.0, < 0.32.2"],"patched":["github.com/kcp-dev/kcp 0.31.4","github.com/kcp-dev/kcp 0.32.2"],"published":"2026-09-18","updated":"2026-09-21","sourceUpdated":"2026-09-21T21:17:07.380","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61682","references":[{"url":"https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca","label":"security-advisories@github.com"},{"url":"https://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff","label":"security-advisories@github.com"},{"url":"https://github.com/kcp-dev/kcp/releases/tag/v0.31.4","label":"security-advisories@github.com"},{"url":"https://github.com/kcp-dev/kcp/releases/tag/v0.32.2","label":"security-advisories@github.com"},{"url":"https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-c8w2-fgvx-vhv4"},{"url":"https://github.com/kcp-dev/kcp"}],"tags":["nvd","cve.org","ghsa","go","osv"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-18T19:24:33.782681Z"},"epss":0.00281,"epssPercentile":0.20766,"aliases":["GHSA-c8w2-fgvx-vhv4"],"ecosystem":"go","ingestedAt":"2026-09-18T16:45:41.387Z","slug":"CVE-2026-61682","body":"## Overview\n\nkcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61682)\n\nAffected packages:\n\n- `github.com/kcp-dev/kcp < 0.31.4`\n- `github.com/kcp-dev/kcp >= 0.32.0, < 0.32.2`\n\nPatched in:\n\n- `github.com/kcp-dev/kcp 0.31.4`\n- `github.com/kcp-dev/kcp 0.32.2`\n\nSource: https://github.com/advisories/GHSA-c8w2-fgvx-vhv4","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}